5 ms·

Get companies to erase your personal data – automated CCPA deletion requests

91 points by yoaviram 7y ago

Havoc 7y ago
Oracle is a data broker? I missed that somehow
- paulmd 7y ago
  If you have an account of some kind with them (cloud services, for example) then I'd imagine they're retaining PII on you (name, billing address, etc).
  - Havoc 7y ago
    Yeah I have cloud services with them. Or had. I dropped it because their stuff is just pure chaos. Of all the companies that might be collecting my info via some dark sorcery...theyre not on my worry list
- mrgreenfur 7y ago
  https://www.oracle.com/corporate/acquisitions/datalogix/ https://www.oracle.com/corporate/acquisitions/datalogix/
  - Havoc 7y ago
    Ah right. Acquisition. That makes more sense
yoaviram 7y ago
I’m one of the founders of this service. We created Your Digital Rights because we believe that privacy matters, and that exercising your right to privacy should be easy. Over the past year thousands of people have used the service to send GDPR erasure requests. We’ve just launched support for the CCPA. I’d love to get your feedback and am happy to answer any questions.
- maikhoepfel 7y ago
  The service looks excellent, but the lack of any privacy notice and details about who you are made me close the tab again. Why the secrecy?
  - wjnc 7y ago
    I see an About and a Privacy policy. Where do you think those are lacking or could be better?
- hnhg 7y ago
  What about 'startup/tech' companies like Telegram? I can't bulk delete data in group chats, which to me seems in violation of my GDPR rights. I also have no idea where they are permanently based or how to properly contact them? They are an immensely shady outfit... Can you help with this case or am I and others just stuck with the mistake of using them?
  - Tenoke 7y ago
    Does telegram even store any accessible data on their servers? As far as I can tell, their use case, in general, isn't covered by the rights to erasure[1] 1. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
    - hnhg 7y ago
      I believe they do store data on their servers. Their desktop app doesn't require syncing to your phone. Can you explain your thinking about why you believe that? I would have interpreted the guidelines in the opposite way. Telegram does permit individual manual deletion of group conversation messages for all parties, and bulk deletion of 1-1 conversation messages for everyone, just not the group chats. It's incredibly inconsistent even by their own standards.
      - 7y ago
timd2112 7y ago
But if I remove from credit bureaus I can't churn credit cards ;)
- VWWHFSfQ 7y ago
  or rent an apartment. or get a car loan. or a mortgage. or some kinds of jobs
  - iandanforth 7y ago
    Being employed is a useable workaround. I've never had anything other than a blank credit history and that usually just triggers a "Can I see proof you can pay" type question.
- patcheudor 7y ago
  or trace back prior fraud. Criminals are using data deletion requests / demands to cover their fraud so they can continue. I don't think as written, this legislation is going to hold up under the onslaught of criminal abuse.
  - gearhart 7y ago
    I don't want to be rude, so please tell me if you do, but do you have a source for that? It sounds quite a lot like a "think of the children" argument and whilst I can see people having made that claim elsewhere, I don't see any actual cases of it being reported.
  - hnhg 7y ago
    I believe that's incorrect under GDPR. There is a legitimate interest to keep records for fraud use, and also they must not delete anything that's required for regulatory compliance. GDPR is very clear on that.
blackearl 7y ago
If I have a PO box in CA can I send CCPA requests for myself or do I need to actually be a resident?
- yoaviram 7y ago
  You need to be a resident, but I have found that many companies will not check and process your request anyway. Microsoft officially said they will do so: https://venturebeat.com/2019/11/11/microsoft-will-honor-californias-ccpa-privacy-law-across-the-u-s/ https://venturebeat.com/2019/11/11/microsoft-will-honor-cali...
kyrieeschaton 7y ago
Wait, so if I know someone's name and email address or username I can probably cause arbitrary companies to delete their account?
- schlimig 7y ago
  Exactly! As a site administrator I've received much abuse from users who have used a "service" such as this. Upon doing my job and legally verifying they own the data, I've frequently been subjected to a torrent of abuse and legal threats - companies such as this foster a belief that you can just enter your details, press go and that's he end of the matter.
- Tenoke 7y ago
  You have to send the request from an email and if you send it from an unrecognized one they'll probably ignore it, have grounds to do so or will ask you for more information in a follow-up email.
  - kyrieeschaton 7y ago
    "Probably" some hazy business process will intervene is not a reassuring guarantee! (And those manual processes are expensive and likely to be automated away to some hackable business logic at some point.)
    - Bartweiss 7y ago
      > those manual processes are expensive and likely to be automated away to some hackable business logic I suppose this depends on who they're manual and expensive for. Some people will probably automate "respond to all agent-based deletion requests with a request for proof of authorization and direct user verification", because it lets them delete as little as possible. But actually checking that info if its provided? Yeah, that sounds less likely. And I'll bet a lot of companies will just obey anyone claiming to be the actual user and providing some piece of personal info.
- Bartweiss 7y ago
Tenoke 7y ago
This looks great! I wish it came with a little blurb on /data-brokers as to what a Company does or how they typically use data. I know I probably 'want' e.g. Experian to have my data but I'd remove any company that is purely ads based for example.
- yoaviram 7y ago
  Great idea, would you mind adding it to our wishlist? https://wishlist.yourdigitalrights.org/ https://wishlist.yourdigitalrights.org/
- deleted 7y ago
  [deleted]
schlimig 7y ago
Services like this are disgraceful. You encourage users to GDPR from services via your system, a third party, which then sends the request on. GDPR and data protection require that companies protect user data and so these requests cannot just be processed without verifying the user is who they say they are. Companies cannot communicate with you as you are a third party and so you're just creating an unnecessary step in the chain and fostering the belief in users that using your service is all they have to do. The number of people who have given me abuse as a site administrator because upon receiving an email from you or your competitors, I've had to verify identity, is beyond a joke now!
- adrr 7y ago
  Did you even go to the site? It just creates a form email that you send with your own email program.
- yoaviram 7y ago
  It's sad that you didn't even bother to try the service, or read the instructions, before posting this comment. All the service does in generate an email which opens up in your local email client. You then send the email on your own. If the company needs any further information they can (and legally have to) reply to your email. We are not a side to this exchange.
Phait 7y ago
I've sent one request as a test, if it works I'll do it systematically for all data brokers listed here https://yourdigitalrights.org/data-brokers https://yourdigitalrights.org/data-brokers Since the devs are around this thread: it would be nice to have an option to send requests in bulk.
- yoaviram 7y ago
  Would you mind voting up this idea on our roadmap? https://wishlist.yourdigitalrights.org/ https://wishlist.yourdigitalrights.org/
javajosh 7y ago
FYI if you send an email to Acxiom you'll get an automated response to redo your submission through their web form https://gdpr.eu.acxiom.com/managePreference https://gdpr.eu.acxiom.com/managePreference. This form is filled with dark patterns, including ones that are outright illegal, I believe. You cannot exclude your phone number under GDPR unless your country code is UK (+44).
MEGMAIL 7y ago
Wow -- this seems like such a good thing. I can't believe there hasn't been a big push to have companies do this until now.
whamlastxmas 7y ago
Will hacker news take down accounts under CCPA?

91 points by yoaviram 7y ago

Havoc 7y ago

Oracle is a data broker? I missed that somehow

paulmd 7y ago
If you have an account of some kind with them (cloud services, for example) then I'd imagine they're retaining PII on you (name, billing address, etc).
- Havoc 7y ago
  Yeah I have cloud services with them. Or had. I dropped it because their stuff is just pure chaos. Of all the companies that might be collecting my info via some dark sorcery...theyre not on my worry list
mrgreenfur 7y ago
https://www.oracle.com/corporate/acquisitions/datalogix/ https://www.oracle.com/corporate/acquisitions/datalogix/
- Havoc 7y ago
  Ah right. Acquisition. That makes more sense

yoaviram 7y ago

I’m one of the founders of this service. We created Your Digital Rights because we believe that privacy matters, and that exercising your right to privacy should be easy. Over the past year thousands of people have used the service to send GDPR erasure requests. We’ve just launched support for the CCPA. I’d love to get your feedback and am happy to answer any questions.

maikhoepfel 7y ago
The service looks excellent, but the lack of any privacy notice and details about who you are made me close the tab again. Why the secrecy?
- wjnc 7y ago
  I see an About and a Privacy policy. Where do you think those are lacking or could be better?
hnhg 7y ago
What about 'startup/tech' companies like Telegram? I can't bulk delete data in group chats, which to me seems in violation of my GDPR rights. I also have no idea where they are permanently based or how to properly contact them? They are an immensely shady outfit... Can you help with this case or am I and others just stuck with the mistake of using them?
- Tenoke 7y ago
  Does telegram even store any accessible data on their servers? As far as I can tell, their use case, in general, isn't covered by the rights to erasure[1] 1. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
  - hnhg 7y ago
    I believe they do store data on their servers. Their desktop app doesn't require syncing to your phone. Can you explain your thinking about why you believe that? I would have interpreted the guidelines in the opposite way. Telegram does permit individual manual deletion of group conversation messages for all parties, and bulk deletion of 1-1 conversation messages for everyone, just not the group chats. It's incredibly inconsistent even by their own standards.
    - 7y ago

timd2112 7y ago

But if I remove from credit bureaus I can't churn credit cards ;)

VWWHFSfQ 7y ago
or rent an apartment. or get a car loan. or a mortgage. or some kinds of jobs
- iandanforth 7y ago
  Being employed is a useable workaround. I've never had anything other than a blank credit history and that usually just triggers a "Can I see proof you can pay" type question.
patcheudor 7y ago
or trace back prior fraud. Criminals are using data deletion requests / demands to cover their fraud so they can continue. I don't think as written, this legislation is going to hold up under the onslaught of criminal abuse.
- gearhart 7y ago
  I don't want to be rude, so please tell me if you do, but do you have a source for that? It sounds quite a lot like a "think of the children" argument and whilst I can see people having made that claim elsewhere, I don't see any actual cases of it being reported.
- hnhg 7y ago
  I believe that's incorrect under GDPR. There is a legitimate interest to keep records for fraud use, and also they must not delete anything that's required for regulatory compliance. GDPR is very clear on that.

blackearl 7y ago

If I have a PO box in CA can I send CCPA requests for myself or do I need to actually be a resident?

yoaviram 7y ago
You need to be a resident, but I have found that many companies will not check and process your request anyway. Microsoft officially said they will do so: https://venturebeat.com/2019/11/11/microsoft-will-honor-californias-ccpa-privacy-law-across-the-u-s/ https://venturebeat.com/2019/11/11/microsoft-will-honor-cali...

kyrieeschaton 7y ago

Wait, so if I know someone's name and email address or username I can probably cause arbitrary companies to delete their account?

schlimig 7y ago
Exactly! As a site administrator I've received much abuse from users who have used a "service" such as this. Upon doing my job and legally verifying they own the data, I've frequently been subjected to a torrent of abuse and legal threats - companies such as this foster a belief that you can just enter your details, press go and that's he end of the matter.
Tenoke 7y ago
You have to send the request from an email and if you send it from an unrecognized one they'll probably ignore it, have grounds to do so or will ask you for more information in a follow-up email.
- kyrieeschaton 7y ago
  "Probably" some hazy business process will intervene is not a reassuring guarantee! (And those manual processes are expensive and likely to be automated away to some hackable business logic at some point.)
  - Bartweiss 7y ago
    > those manual processes are expensive and likely to be automated away to some hackable business logic I suppose this depends on who they're manual and expensive for. Some people will probably automate "respond to all agent-based deletion requests with a request for proof of authorization and direct user verification", because it lets them delete as little as possible. But actually checking that info if its provided? Yeah, that sounds less likely. And I'll bet a lot of companies will just obey anyone claiming to be the actual user and providing some piece of personal info.
Bartweiss 7y ago

Tenoke 7y ago

This looks great! I wish it came with a little blurb on /data-brokers as to what a Company does or how they typically use data. I know I probably 'want' e.g. Experian to have my data but I'd remove any company that is purely ads based for example.

yoaviram 7y ago
Great idea, would you mind adding it to our wishlist? https://wishlist.yourdigitalrights.org/ https://wishlist.yourdigitalrights.org/
deleted 7y ago
[deleted]

schlimig 7y ago

Services like this are disgraceful. You encourage users to GDPR from services via your system, a third party, which then sends the request on. GDPR and data protection require that companies protect user data and so these requests cannot just be processed without verifying the user is who they say they are. Companies cannot communicate with you as you are a third party and so you're just creating an unnecessary step in the chain and fostering the belief in users that using your service is all they have to do. The number of people who have given me abuse as a site administrator because upon receiving an email from you or your competitors, I've had to verify identity, is beyond a joke now!

adrr 7y ago
Did you even go to the site? It just creates a form email that you send with your own email program.
yoaviram 7y ago
It's sad that you didn't even bother to try the service, or read the instructions, before posting this comment. All the service does in generate an email which opens up in your local email client. You then send the email on your own. If the company needs any further information they can (and legally have to) reply to your email. We are not a side to this exchange.

Phait 7y ago

I've sent one request as a test, if it works I'll do it systematically for all data brokers listed here https://yourdigitalrights.org/data-brokers https://yourdigitalrights.org/data-brokers Since the devs are around this thread: it would be nice to have an option to send requests in bulk.

yoaviram 7y ago
Would you mind voting up this idea on our roadmap? https://wishlist.yourdigitalrights.org/ https://wishlist.yourdigitalrights.org/

javajosh 7y ago

FYI if you send an email to Acxiom you'll get an automated response to redo your submission through their web form https://gdpr.eu.acxiom.com/managePreference https://gdpr.eu.acxiom.com/managePreference. This form is filled with dark patterns, including ones that are outright illegal, I believe. You cannot exclude your phone number under GDPR unless your country code is UK (+44).

MEGMAIL 7y ago

Wow -- this seems like such a good thing. I can't believe there hasn't been a big push to have companies do this until now.

whamlastxmas 7y ago

Will hacker news take down accounts under CCPA?